Analysis
-
max time kernel
300s -
max time network
303s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:19
Static task
static1
Behavioral task
behavioral1
Sample
Comprobante Retenciones 24.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
Comprobante Retenciones 24.exe
-
Size
3.9MB
-
MD5
c356527a53eb92909769240bc8d21f71
-
SHA1
853e49f7b3fa0d998141e782bad9bd7bd5ffc09e
-
SHA256
c31db09abd0d5b4b33b628dc48967247a77941759c24920603219dd66baf5778
-
SHA512
cd7a9492246816346a58325dc9fba0757bb793ee36b8edbb789704b0afa6fcf2a10e09e67082036e0811ad3793a11112fe90fec25e48212f69f91d73d62d7e98
-
SSDEEP
49152:GcHin0YtLXoVeXUmWDAk7Og2mp4BbF4L58w8LKWftklC5lY:G/n08XQO0
Malware Config
Extracted
Family
bandook
C2
deapproved.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4316-156-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4316-157-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4316-158-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4316-159-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4316-161-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4316-163-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4316-167-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/4316-154-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-155-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-156-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-157-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-158-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-159-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-161-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-163-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4316-167-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 4316 msinfo32.exe 4316 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Comprobante Retenciones 24.exedescription pid process target process PID 2424 wrote to memory of 4316 2424 Comprobante Retenciones 24.exe msinfo32.exe PID 2424 wrote to memory of 4316 2424 Comprobante Retenciones 24.exe msinfo32.exe PID 2424 wrote to memory of 4316 2424 Comprobante Retenciones 24.exe msinfo32.exe PID 2424 wrote to memory of 3108 2424 Comprobante Retenciones 24.exe Comprobante Retenciones 24.exe PID 2424 wrote to memory of 3108 2424 Comprobante Retenciones 24.exe Comprobante Retenciones 24.exe PID 2424 wrote to memory of 3108 2424 Comprobante Retenciones 24.exe Comprobante Retenciones 24.exe PID 2424 wrote to memory of 4316 2424 Comprobante Retenciones 24.exe msinfo32.exe PID 2424 wrote to memory of 4316 2424 Comprobante Retenciones 24.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Comprobante Retenciones 24.exe"C:\Users\Admin\AppData\Local\Temp\Comprobante Retenciones 24.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Comprobante Retenciones 24.exe"C:\Users\Admin\AppData\Local\Temp\Comprobante Retenciones 24.exe" dkddkdkkdkdd ddd2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2424-133-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/2424-134-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-135-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-136-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-137-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-149-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-150-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-151-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-179-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-153-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/2424-165-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/3108-164-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/3108-166-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/3108-152-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/3108-170-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/3108-168-0x0000000000400000-0x00000000007F0000-memory.dmpFilesize
3.9MB
-
memory/4316-155-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-163-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-156-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-154-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-161-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-167-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-159-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-158-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4316-157-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB